Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-10-2024 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe
-
Size
173KB
-
MD5
305f37807bec7afd8e310b1334e63b5c
-
SHA1
18253edd3c6799c3a58d4e1461932a442a90ff8f
-
SHA256
5334aaef334167fc6ff2c3eae74982f4818bd609168f9f38b5ad3504db0a7480
-
SHA512
0eecdffe24eba134241e9815b3f5b46cffd1b74a1fab9a8bfdca03aa9c63fc698f6f6af26c9cf0729c1a7a397136f1a987ca2b8c5dcd6209f33e154feaa5f444
-
SSDEEP
3072:P+bzgbUy8RvsIz7JD2F0j4D1t53zVQRkVEJhX/4mVwujNQnc4CKH:mbzao0g7oF0j45t53zyVfX//VwWN4cs
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2096 mscorsvw.exe 2676 mscorsvw.exe 2988 OSE.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\S-1-5-21-1506706701-1246725540-2219210854-1000 OSE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\S-1-5-21-1506706701-1246725540-2219210854-1000\EnableNotifications = "0" OSE.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: OSE.EXE File opened (read-only) \??\L: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\T: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\R: OSE.EXE File opened (read-only) \??\R: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\V: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\L: OSE.EXE File opened (read-only) \??\S: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\X: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\G: OSE.EXE File opened (read-only) \??\E: OSE.EXE File opened (read-only) \??\I: OSE.EXE File opened (read-only) \??\N: OSE.EXE File opened (read-only) \??\O: OSE.EXE File opened (read-only) \??\V: OSE.EXE File opened (read-only) \??\E: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\G: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\P: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\Z: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\K: OSE.EXE File opened (read-only) \??\Z: OSE.EXE File opened (read-only) \??\O: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\Q: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\U: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\J: OSE.EXE File opened (read-only) \??\Q: OSE.EXE File opened (read-only) \??\M: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\N: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\Y: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\S: OSE.EXE File opened (read-only) \??\X: OSE.EXE File opened (read-only) \??\H: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\I: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\W: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\M: OSE.EXE File opened (read-only) \??\P: OSE.EXE File opened (read-only) \??\T: OSE.EXE File opened (read-only) \??\U: OSE.EXE File opened (read-only) \??\W: OSE.EXE File opened (read-only) \??\J: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\K: 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened (read-only) \??\H: OSE.EXE -
Drops file in System32 directory 36 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\searchindexer.vir 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\svchost.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe OSE.EXE File opened for modification \??\c:\windows\syswow64\perfhost.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\lsass.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\msdtc.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe OSE.EXE File created \??\c:\windows\SysWOW64\dllhost.vir 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\wbengine.exe OSE.EXE File created \??\c:\windows\SysWOW64\svchost.vir 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\alg.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\locator.exe OSE.EXE File created \??\c:\windows\SysWOW64\msiexec.vir 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe OSE.EXE -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7z.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File created \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe OSE.EXE File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe -
Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe OSE.EXE File opened for modification \??\c:\windows\ehome\ehrecvr.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B10CC5D4-325A-4319-97EC-0945B8A4FCF9}.crmlog dllhost.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe OSE.EXE File created \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\ehome\ehsched.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe OSE.EXE File opened for modification \??\c:\windows\ehome\ehrecvr.exe OSE.EXE File opened for modification \??\c:\windows\ehome\ehsched.exe OSE.EXE File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe OSE.EXE File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B10CC5D4-325A-4319-97EC-0945B8A4FCF9}.crmlog dllhost.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe OSE.EXE File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe OSE.EXE File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe OSE.EXE File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe OSE.EXE -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE 2988 OSE.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2116 305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeSecurityPrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 OSE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\305f37807bec7afd8e310b1334e63b5c_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2096
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
PID:2676
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:1644
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD5e439430997faf032bb90db4cb3cfb85d
SHA1f5faec3b5a9b6a72e3434ed146fe1cf6fbf692a8
SHA256d15fafd0644267bcef470fe5eb5b87aac659560e973ed4843881b06f644afddb
SHA51298f9d641157b47abf6a5046488da7c77a4a80875265267bd18395926ff167635c24a0c73e8979e9614a2b28a6126bafbc5364c9da43b6a242b9e7133c380801c
-
Filesize
1.2MB
MD58174bc516ba6943da8e0f2daec453f27
SHA1414db3d2b6875d529a290517033fbf8002a4b319
SHA256f4a842742e5554defbac5cefa75c8d8313191d0ec0b7d6a3ddeb7a1dfbb1364a
SHA512a9b0a6951aa76a1cc37b470a9089237652e2c1c6f6dc9aa0200f1356e2653b0a216bc3082c14659be59657323ee890ae92338129837add13dc12e0bbdbafcb96
-
Filesize
284KB
MD540ffee3c2f8ca7592c3bdc5dc1533851
SHA17a0687aeca3636314bee87fb408644d64a6fd7a7
SHA256004e5e23e80aa33f5c571bd47a2ed3b1a4d95c35d1562deacf6e80ffbda15b34
SHA512d14e69ebb2534888ffc7b84a9e8b970b26494fa6c9fe445fffb4107602f3398ee07dfe47f7b4a819151cec38b8ed372e756d5a294fe9aa9c191659158cd27c11
-
Filesize
203KB
MD56975955ff1196f01b2e6cebd9e2a2245
SHA111e3b78f62d9eded0855541c9cd0f276e254e3a5
SHA256629ba16b1b5aa0aa9b5caeacb8464e5385270d9f237c58f59c47197cdc32781a
SHA512db5b49c6de8d7dbc55a545be4a223a0cfbeed074a5ddfb915af75cf4ee79dde9fe6e01a5dbd2ac171add86cb04b1adc00b3fe5f41753a6c8c99a7e4b24665e53
-
Filesize
1003KB
MD5b6f083487e3731d9a4dc377f326ee8e8
SHA11e9dd8d74cc314bec5a85505e99ccaf56e2239db
SHA25601cda1a7c2d0222ac828947aaf7aa750070e91d5dfa422392e1910b20ff77fb3
SHA512dd40ef9d5247d774fedabf4cf833555a80a02a282dd4a066e739831328719432799e69a02363f01706b210fabac75b9a0dd0918e49535ed303b08add335340f4
-
Filesize
234KB
MD5c6c732914e2304fcd5849477c370a609
SHA1012786df00bee7ec29c8e7eb3f050bb9a760a387
SHA256ce6ad341a836d1de67f9d94d29648d42d16044f3544f318d26b9423167405ffc
SHA5129c9eabae7e142ec885d6765d82f1980423ebddd4673338d0cd392f5806ba21ff4f95a6f4df22100ce4432ff057d250c8cc5fe5d90d6897a320d3efa5f09f070e
-
Filesize
29.7MB
MD5e068658d58e2c1381dbcd1ec0d67dae3
SHA1e9013f3d574dd833d34cbd9ec3a2fca0ce60e345
SHA256c86e9bef1d8b6219f093326d1b3f684556ba8bc86db46bdff3b41910ef9ba73d
SHA512ba28fc51c3721b7a72caa3ee96a1080294d3d8c3abd3811fa984a560e5893f8c9cae0a008d8b19d876b9f37e2ad450b635bfa84765e3b914e8572d3f3a45cfbd
-
Filesize
562KB
MD569463397cf4274e88393c16431f89499
SHA184af0606d9a318c3b2421b2d0dc975d241441621
SHA256c5ce32d85313a1817f58a6e6d85603b47b017c280538f3bcb73ff72d17b69d10
SHA5123fe484ae9403b645ab5c55d836e640a0b1d25a5ec1a27549d05f401b473e167c208187a1a6e2df549495894d61cbbea28fade093176a39a5a3e4b6c9d9ea6646
-
Filesize
164KB
MD503631748745a66f283e6ac5de52eb3b1
SHA1a4acec58f9ac95d289dd6adbe61bb6b991f4eab6
SHA2563e3431aab8fa70ae65ab3781d2bcac05c7cdabf854ce02d155c917807b867d62
SHA5124ecdd58ec8c6dcbe38f6506a5ac41c4ac644beb81f2a5dc0828882474cc22bd518f0e41700a332bbc496b131c1c027bf2441e038a275d70d04f45b090c7e5325